CVE-2008-2545 Skype 3.6.0.248, and other versions before 3.8.0.139, uses a case-sensitive comparison when checking for dangerous extensions, which allows user-assisted remote attackers to bypass warning dialogs and...
HighCVSS 9.3
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Skype 3.6.0.248, and other versions before 3.8.0.139, uses a case-sensitive comparison when checking for dangerous extensions, which allows user-assisted remote attackers to bypass warning dialogs and possibly execute arbitrary code via a file: URI with a dangerous extension that uses a different case.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| skype technologies skype | <= 3.8.0.115 | No fix listed |
| skype technologies skype | = 3.0.0.106-beta | No fix listed |
| skype technologies skype | = 3.0.0.123-beta | No fix listed |
| skype technologies skype | = 3.0.0.137-beta | No fix listed |
| skype technologies skype | = 3.0.0.154-beta | No fix listed |
| skype technologies skype | = 3.0.0.190 | No fix listed |
| skype technologies skype | = 3.0.0.198 | No fix listed |
| skype technologies skype | = 3.0.0.205 | No fix listed |
| skype technologies skype | = 3.0.0.209 | No fix listed |
| skype technologies skype | = 3.0.0.214 | No fix listed |
| skype technologies skype | = 3.0.0.216 | No fix listed |
| skype technologies skype | = 3.0.0.217 | No fix listed |
| skype technologies skype | = 3.0.0.218 | No fix listed |
| skype technologies skype | = 3.1.0.112-beta | No fix listed |
| skype technologies skype | = 3.1.0.134-beta | No fix listed |
| skype technologies skype | = 3.1.0.144 | No fix listed |
| skype technologies skype | = 3.1.0.147 | No fix listed |
| skype technologies skype | = 3.1.0.150 | No fix listed |
| skype technologies skype | = 3.1.0.152 | No fix listed |
| skype technologies skype | = 3.2.0.53-beta | No fix listed |
| skype technologies skype | = 3.2.0.63-beta | No fix listed |
| skype technologies skype | = 3.2.0.82-beta | No fix listed |
| skype technologies skype | = 3.2.0.115-beta | No fix listed |
| skype technologies skype | = 3.2.0.145 | No fix listed |
| skype technologies skype | = 3.2.0.148 | No fix listed |
Show 18 more
| Product | Affected versions | Fixed in |
|---|---|---|
| skype technologies skype | = 3.2.0.152 | No fix listed |
| skype technologies skype | = 3.2.0.158 | No fix listed |
| skype technologies skype | = 3.2.0.163 | No fix listed |
| skype technologies skype | = 3.2.0.175 | No fix listed |
| skype technologies skype | = 3.5.0.107-beta | No fix listed |
| skype technologies skype | = 3.5.0.158-beta | No fix listed |
| skype technologies skype | = 3.5.0.178-beta | No fix listed |
| skype technologies skype | = 3.5.0.202 | No fix listed |
| skype technologies skype | = 3.5.0.214 | No fix listed |
| skype technologies skype | = 3.5.0.229 | No fix listed |
| skype technologies skype | = 3.5.0.234 | No fix listed |
| skype technologies skype | = 3.5.0.239 | No fix listed |
| skype technologies skype | = 3.6.0.127-beta | No fix listed |
| skype technologies skype | = 3.6.0.159-beta | No fix listed |
| skype technologies skype | = 3.6.0.216 | No fix listed |
| skype technologies skype | = 3.6.0.244 | No fix listed |
| skype technologies skype | = 3.6.0.248 | No fix listed |
| skype technologies skype | = 3.8.0.96-beta | No fix listed |
References
- 20080604 Skype File URI Security Bypass Code Execution Vulnerability third-party-advisory
- 30547 third-party-advisory
- 29553 vdb-entry
- 1020201 vdb-entry
- www.skype.com patch
- ADV-2008-1749 vdb-entry
- skype-fileuri-case-security-bypass(43044) vdb-entry